deytenit
9ee672504f
🤖 Pull request created from `various-fixes` containing PageHead
breadcrumbs and navigation alignment fixes, Umami analytics proxy, and
infrastructure updates.
52 lines
1.3 KiB
Bash
Executable File
52 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eu
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
|
|
echo "=== Sanitizing Machine Identity & Temporary Files ==="
|
|
|
|
# Lock temporary packer build user
|
|
passwd -l debian || true
|
|
|
|
# Apply SSH security hardening before final image capture
|
|
mkdir -p /etc/ssh/sshd_config.d
|
|
cat << 'EOF' > /etc/ssh/sshd_config.d/99-security-hardening.conf
|
|
PasswordAuthentication no
|
|
PermitRootLogin prohibit-password
|
|
KbdInteractiveAuthentication no
|
|
X11Forwarding no
|
|
MaxAuthTries 3
|
|
ClientAliveInterval 300
|
|
ClientAliveCountMax 2
|
|
EOF
|
|
|
|
# Clean APT caches and logs
|
|
apt-get autoremove -y --purge
|
|
apt-get clean
|
|
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
|
|
|
|
# Reset machine-id for unique DHCP lease acquisition on clone
|
|
truncate -s 0 /etc/machine-id
|
|
rm -f /var/lib/dbus/machine-id
|
|
ln -sf /etc/machine-id /var/lib/dbus/machine-id
|
|
|
|
# Ensure SSH host keys are generated and valid
|
|
ssh-keygen -A
|
|
|
|
# Reset DNS with reliable fallback resolvers
|
|
rm -f /etc/cloud/cloud-init.disabled /run/systemd/generator*/cloud-init.disabled
|
|
cat << 'EOF' > /etc/resolv.conf
|
|
nameserver 1.1.1.1
|
|
nameserver 8.8.8.8
|
|
nameserver 77.88.8.8
|
|
EOF
|
|
cloud-init clean --logs --seed || true
|
|
rm -rf /var/lib/cloud/*
|
|
|
|
# Clean bash history
|
|
rm -f /root/.bash_history /home/*/.bash_history
|
|
|
|
# Sync filesystem
|
|
sync
|
|
|
|
echo "=== Cleanup Complete ==="
|